Tailwind-Cli not signed for MacOS and therefor fails with the error "Tailwind-Cli is damaged and can't be opened. You should move it to the trash."

[propstat-dev]

Issue Description
MacOS gotten over the years much more uptight on signing requirements for binaries and currently the MacOS client can't be executed frequently failing with following error:

The issue is currently described here: #19548 (comment)

What version of Tailwind CSS are you using?

All Versions

What build tool (or framework if it abstracts the build tool) are you using?

MacOS

What operating system are you using?

macOS

Reproduction URL
N/A

Workaround

The following code renders the tailwind binary executable on MacOS:

cd ./tools/tailwind/tailwind-macos-*-v*** # Replace * with your architecture and version
xattr -l tailwind-macos-*-v*** # Replace * with your architecture and version
xattr -d com.apple.quarantine tailwind-macos-*-v*** # Replace * with your architecture and version
chmod +x tailwind-macos-*-v*** # Replace * with your architecture and version
./tailwindcss-macos-arm64 --help # Test if you can run the file without errors now. 

A much more elegant approach though would be to notarize the tailwind-cli, below an example for a worker

name: Build and Sign macOS App

on:
  release:
    types: [created]

jobs:
  build-macos:
    runs-on: macos-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install deps
        run: npm ci

      - name: Build TypeScript
        run: npm run build

      # 🔐 Import certificate
      - name: Import signing certificate
        run: |
          echo "$MAC_CERTIFICATE" | base64 --decode > certificate.p12

          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain

          security import certificate.p12 \
            -k build.keychain \
            -P "$MAC_CERTIFICATE_PASSWORD" \
            -T /usr/bin/codesign

          security set-key-partition-list -S apple-tool:,apple: \
            -s -k "$KEYCHAIN_PASSWORD" build.keychain
        env:
          MAC_CERTIFICATE: ${{ secrets.MAC_CERTIFICATE }}
          MAC_CERTIFICATE_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}

      # 📦 Package app (example with pkg or electron-builder)
      - name: Build app bundle
        run: |
          npm run package

      # ✍️ Sign app
      - name: Sign app
        run: |
          codesign --deep --force --verify --verbose \
            --sign "Developer ID Application" \
            dist/MyApp.app

      # 🔎 Verify signature
      - name: Verify signature
        run: |
          codesign --verify --deep --strict --verbose=2 dist/MyApp.app

      # 🧾 Notarize
      - name: Notarize app
        run: |
          xcrun notarytool submit dist/MyApp.zip \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_APP_PASSWORD" \
            --team-id "$TEAM_ID" \
            --wait

      # 📌 Staple notarization
      - name: Staple
        run: |
          xcrun stapler staple dist/MyApp.app

      # 📤 Upload artifact
      - name: Upload release asset
        uses: softprops/action-gh-release@v2
        with:
          files: dist/MyApp.zip